CVE-2026-106138

In Progress® KendoReact @progress/kendo-react-charts starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a stri...

@mais-tech/renault-ui-library (>=0.1.132, <=0.1.144), amarpanchal-report-publish (>=1.3.73, <=1.3.85) +15 more potentially affected by CVE-2026-106138 via @progress/kendo-react-charts (>=3.18.0, <=9.5.0)

@progress/kendo-react-charts NPM version =3.18.0, =0.1.132, =1.3.73, =1.1.1, =2.1.3, =0.0.2, =0.0.1, =5.4.1, =1.3.33, =1.3.86, =1.7.2 and more Source cves: CVE-2026-106138 Source advisory: MEND:CVE-2026-106138...

CVE-2026-106138

In Progress® KendoReact @progress/kendo-react-charts starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a stri...

EUVD-2026-96304

In Progress® KendoReact @progress/kendo-react-charts starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a stri...

CVE-2026-106138

The In Progress® KendoReact (@progress/kendo-react-charts) component versions 1.1.0 through 16.2.0 are vulnerable to Cross-Site Scripting (XSS) . The root cause is that the default Chart tooltip renders formatted point values as raw HTML without proper encoding in both single-point and shared too...

PT-2026-109636

Name of the Vulnerable Software and Affected Versions @progress/kendo-react-charts versions 1.1.0 through 16.1.x Description The default Chart tooltip renders formatted point values as raw HTML without encoding in both single-point and shared tooltips. An attacker with low privileges who can...

CVE-2026-106138: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

In Progress® KendoReact @progress/kendo-react-charts starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a stri...